Appendix C Confidentiality

1. Appendix C
   Confidentiality

CONFIDENTIALITY AGREEMENT

2007–2008 National Postsecondary Student Aid Study (NPSAS:08)

(RTI Under Contract No. ED-05-CO-0033)

Safeguards for Individuals Against Invasion of Privacy: In accordance with the Privacy Act of 1974 (5 United States Code 552a), the Education Sciences Reform Act of 2002 (Public Law 107-279), the Federal Statistical Confidentiality Order of 1997, the E-Government Act of 2002 (Public Law 107-347), the Computer Security Act of 1987, the National Center for Education Statistics’ (NCES’) Restricted Use Data Procedures Manual, and NCES’ Standards and Policies, RTI International (RTI) and all its subcontractors are required to comply with the applicable provisions of the legislation, regulations, and guidelines and to undertake all necessary safeguards for individuals against invasions of privacy.

To provide this assurance and these safeguards in performance of work on this project, all staff, consultants, and agents of RTI, and its subcontractors who have any access to study data, shall be bound by the following assurance.

Assurance of Confidentiality

1. In accordance with all applicable legislation, regulations, and guidelines, RTI assures all respondents that the confidentiality of their responses to all information requests will be maintained by RTI and NCES, and that no information obtained in the course of this activity may be disclosed in a manner in which the individual is identifiable, unless the individual has consented to such disclosure, to anyone other than authorized staff, consultants, agents, or representatives of RTI, its subcontractors, and NCES.

2. The following safeguards will be implemented to assure that confidentiality is protected by all employees, consultants, agents, and representatives of RTI and all subcontractors and that physical security of the records is provided:

1. All staff with access to data will take an oath of nondisclosure and sign an affidavit to that effect.

2. At each site where these items are processed or maintained, all confidential records that will permit identification of individuals shall be kept in a safe, locked room when not in use or personally attended by project staff.

3. When confidential records are not locked, admittance to the room or area in which they reside shall be restricted to staff sworn to confidentiality on this project.

4. All electronic data shall be maintained in secure and protected data files, and personally identifying information shall be maintained on separate files from statistical data collected under this contract.

5. All data files on network or multi-user systems shall be under strict control of a database manager with access restricted to project staff sworn to confidentiality, and then only on a need-to-know basis.

6. All data files on single-user computers shall be password protected and all such machines will be locked and maintained in a locked room when not attended by project staff sworn to confidentiality.

7. External electronically stored data files (e.g., tapes on diskettes) shall be maintained in a locked storage device in a locked room when not attended by project staff sworn to confidentiality.

8. Any data released to the general public shall be appropriately masked or perturbated such that linkages to individually identifying information are not possible and individual identification cannot be disclosed.

9. Data or copies of data may not leave the authorized site for any reason.

3. Staff, consultants, agents, or RTI and all its subcontractors will take all necessary steps to ensure that the letter and intent of all applicable legislation, regulations, and guidelines are enforced at all times through appropriate qualifications standards for all personnel working on this project and through adequate training and periodic follow-up procedures.

By my signature affixed below, I hereby swear and affirm that I have carefully read this statement and fully understand the statement as well as legislative and regulatory assurances that pertain to the confidential nature of all records to be handled in regard to this project, and will adhere to all safeguards that have been developed to provide such confidentiality. As an employee, consultant, agent, or representative of RTI or one of its subcontractors, consultants, agents, or representatives, I understand that I am prohibited by law from disclosing any such confidential information to anyone other than staff, consultant, agents, or representatives of RTI, its subcontractors, or agents, and NCES. I understand that any willful and knowing individual disclosure or allowance of disclosure in violation of the applicable legislation, regulations, and guidelines is punishable by law and would subject the violator to possible fine or imprisonment.

/ / /(Signature) (RTI Employee ID Number) (Date)

/ / /(Supervisor's Signature) (RTI Employee ID Number) (Date)

AFFIDAVIT OF NONDISCLOSURE

2007–2008 National Postsecondary Student Aid Study (NPSAS:08)

(RTI Under Contract No. ED-05-CO-0033)

(Name)
(Job Title)
(Date of Assignment to NPSAS:08 Project)
(Organization, State, or Local Agency or Instrumentality)
(Address)

I, _________________________________, do solemnly swear (or affirm) that when given access to any 2007-2008 National Postsecondary Student Aid Study (NPSAS:08) project-related data bases or files containing individually identifiable information, I will not:

1. use or reveal any individually identifiable information furnished, acquired, retrieved or assembled by me or others, under the provisions of Section 183 of the Education Sciences Reform Act of 2002 (PL 107-279) and Title V, subtitle A of the E-Government Act of 2002 (PL 107-347) for any purpose other than statistical purposes specified in the NCES survey, project or contract;

2. make any disclosure or publication whereby a sample unit or survey respondent could be identified or the data furnished by or related to any particular person under this section could be identified; or

3. permit anyone other than the individuals authorized by the Commissioner of the National Center for Education Statistics to examine the individual reports.

__________________________________

(Signature)

(The penalty for unlawful disclosure is a fine of not more than $250,000 [under 18 U.S.C. 3571] or imprisonment for not more than 5 years [under 18 U.S.C. 3559], or both. The word "swear" should be stricken out wherever it appears when a person elects to affirm the affidavit rather than to swear to it.)

State of _________________________

County of ________________________

Subscribed and sworn/affirmed before me, _____________________________, a Notary Public in and for ______________________County, State of ________________________, on this date, _______________.

___________________________________________

Notary Public

My commission expires: ____________________________________.

September 15, 2006

Institution Coordinator

Title

Institution Name

Address

Address

Dear Dr. Coordinator,

I am writing to provide you with important information regarding the confidentiality of the data collected for the 2008 National Study of Postsecondary Student Aid, which is being conducted for the National Center for Education Statistics, U.S. Department of Education.

I want to assure you that this data request is in full compliance with all applicable federal laws protecting the confidentiality of students, as detailed in the information enclosed.

RTI International (RTI), as contracted by NCES, has been given the authority to collect information from institutional records under the provisions of the Family Educational Rights and Privacy Act of 1974 (FERPA) [20 U.S.C. 1232g], the Education Sciences Reform Act of 2002 (P.L. 107-279), and its predecessor, the National Education Statistics Act of 1994 (P.L. 103-382). FERPA allows the release of institutional record information to the Secretary of Education or his agent without prior consent of survey members [20 U.S.C. 1232g (b) (3)]. Since RTI is an authorized representative of the Secretary of Education, compliance with RTI’s official request for information constitutes compliance with FERPA and the General Education Provisions Act.

Privacy and confidentiality are always of concern to institutions and offices that maintain student and employee records. Both NCES and RTI follow strict confidentiality procedures to protect the privacy and confidentiality of study participants. A description of our security arrangements is enclosed, but let me underscore that these data will be combined to produce reports for Congress and other policymakers. Individually identifiable data will be available only to a limited number of qualified researchers, who will be pledged, under penalty of law with severe fines and imprisonment, to maintain the confidentiality of the data.

Your cooperation with RTI in this important study is greatly appreciated. For further information or questions, please contact Dr. James Griffith, the NCES Project Director at 1–202–502–7387 or Dr. John Riccobono, the RTI Project Director, at 1–919-541-7006.

S incerely,

Mark Schneider

Commissioner

NCES

Attachments:

Fact Sheet: Confidentiality Law and the 2008 National Postsecondary Student Aid Study

Selected pages from the Family Education Rights and Privacy Act of 1974 (FERPA) [34 CFR Part 99]

CONFIDENTIALITY LAW FACT SHEET

For

THE 2008 NATIONAL POSTSECONDARY STUDENT AID STUDY

Your institution has been selected to participate in the 2008 National Postsecondary Student Aid Study. NPSAS is designed to provide information on how students and their families meet the cost of education beyond high school. Lists of students provided by institutions will be used to select a smaller sample of these individuals who will be asked to complete a questionnaire online.

Data Collected for NPSAS

The information collected for students includes demographic information used for sampling (such as race/ethnicity), contact information used to inform respondents of the survey request (such as address and telephone number) and personal identifiers (such as social security numbers and student ID). The security of this information is, of course, of paramount importance to NCES and its contractors, as well as to participating institutions and respondents. It is important for each institution sampled to be fully aware of the federal laws that both authorize the release of student information, and protect the confidentiality of record data and survey responses.

Data Collected for NPSAS is Authorized by Congress

The Education Sciences Reform Act (ESRA) of 2002 (P.L. 107-279), and its predecessor, the National Education Statistics Act (NESA) of 1994 (P.L. 103-382), authorize the U.S. Department of Education, National Center for Education Statistics (NCES), to collect, acquire, compile, and disseminate full and complete statistics on the condition and progress of education, including postsecondary education. The provisions of ESRA can be found at the following website: http://www.ed.gov/policy/rschstat/leg/edpicks.jhtml?src=ln.

Federal Law Strictly Protects the Confidentiality of Data Collected for NPSAS

Strict confidentiality of all information obtained from NPSAS:08 is assured by current federal laws and regulations. The Education Sciences Reform Act of 2002 (ESRA) (Public Law 107-279) establishes that NCES and its contractors, under penalty of law, must keep all records on individuals confidential. Researchers are subject to fines and imprisonment for misuse or disclosure of individual data. Procedures have been implemented to ensure confidentiality and privacy of all information obtained.

Individual responses are safeguarded by the following laws that protect the confidentiality of individually identifiable information collected by the National Center for Education Statistics (NCES): The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. 1232g; 34 CFR Part 99) the Privacy Act of 1974 (5 United States Code 552a), the Education Sciences Reform Act of 2002 (ESRA) (Public Law 10-279) its predecessor, the National Education Statistics Act of 1994 (NESA) (Public Law 103-382) as amended by the USA PATRIOT Act of 2001 (Public Law 107-56), and the E-Government Act of 2002 (Public Law 107-347).

A summary of the laws that cover the confidentiality of personally identifiable information collected by NCES can be found at the following website: http://nces.ed.gov/statprog/conflaws.asp.

Federal Law Authorizes Release of Personally Identifiable Information to NCES and Its Agents and Assures Confidentiality

NPSAS:08 seeks both directory and personally identifiable information on students from institutions. The Education Sciences Reform Act of 2002 (P.L. 107-279), and its predecessor, the National Education Statistics Act of 1994 (P.L. 103-382), authorize NCES, and its contractor, RTI International, to periodically gather information from students on pivotal areas of national concern.

CONFIDENTIALITY LAW FACT SHEET

For

THE 2008 NATIONAL POSTSECONDARY STUDENT AID STUDY

The data request for NPSAS fully conforms to the requirements of the Family Education Rights and Privacy Act of 1974. (FERPA) [20 U.S.C. 1232g; 34 CFR Part 99]. FERPA is designed to protect the privacy rights of students and their families, by providing consistent standards for the release of personally identifiable student

and family information. NCES and its agent, RTI International, are explicitly authorized under an exception to FERPA’s general consent rule (in which the right to consent is held by the student, regardless of age) to obtain student level data from institutions. This exception provides for the collection of data on any eligible student, without prior consent if the disclosure is to an organization conducting studies for, or on behalf of educational agencies or institutions. The data are subject to strict confidentiality protections, which must be adhered to by both NCES and RTI.

FERPA requires educational institutions to maintain a record of the disclosure of student information to NCES (see 34 CFR 99.32). The record of disclosure must include 1) the parties who have requested or received personally identifiable information records (NCES/RTI) and 2) the legitimate interests the parties had in obtaining the information (the 2008 National Postsecondary Student Aid Study).

For questions regarding the applicability of FERPA to this study, school officials may contact the Family Policy Compliance Office (FPCO) at this e-mail address: [email protected]. The provisions of FERPA may be found at the following website: http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html.

Review Processes to Protect Privacy Rights of Respondents

In addition to being authorized by legislation to collect personally identifiable information, NPSAS:08 has gone through several reviews. The study was reviewed by the U.S. Department of Education’s Regulatory Information Management Group and has received clearance from the Office of Management and Budget (OMB Clearance #: xxxx-xxxx).

The study and all related instruments and procedures have also been reviewed by RTI’s own Institutional Review Board, which maintains strict standards for the protection of human subjects (including respondents to surveys). Questions about RTI’s review procedures regarding the rights and protections of study participants may be directed to Dr. Wendy A. Visscher at 1-866-214-2043.

A plan for ensuring confidentiality of this project has been developed by NCES and RTI. This plan includes signed confidentiality agreements obtained from all personnel who will have access to individual identifiers, personnel training regarding the meaning of confidentiality, and controlled access to computer files.

All electronic data from institution records and students will be carefully protected. Computer accounts used to access electronic data will be password protected. Only project staff members with clearance from the study database manager will be able to log on to these accounts. Personally identifying variables (e.g., name, address, and phone numbers) will be kept separate from data variables such as educational experience or financial aid. Backups and inactive files will be maintained on tape or CD-ROM in locked storage.

All hardcopy records will be maintained in locked storage cabinets. A unique study identification variable (not the social security number or student ID) will be created and maintained for each survey participant to protect against inadvertent disclosure of confidential data. Any data released to the general public (for example, statistical tables) will be tailored so that it is not possible to identify specific individuals or institutions.

Supporting Statement Request for OMB Review (SF83i) C-1